CVE-2021-43138

FAUCET Score

CVE-2021-43138 is a prototype pollution vulnerability affecting the Async library (versions before 2.6.4 and 3.x before 3.2.2) and related Fedora projects. A malicious user can exploit the mapValues() method to gain elevated privileges. This vulnerability has a high CVSS score of 7.8, indicating a significant risk with local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 2.6.4CPE matchmatch criteria	cpe:2.3:a:async_project:async::::::::
		>= 3.0.0, < 3.2.2CPE matchmatch criteria	cpe:2.3:a:async_project:async::::::::
		36CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:36:::::::*
		37CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:37:::::::*

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.8

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

3.35%

Probability of exploitation in next 30 days

EPSS Percentile

87.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0335 is in the 88th percentile among its peer group of 11,617 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (32)

github_advisorypatch availablevia nvd_reference

View patch

npmpatch availablevia ghsa

Product: asyncFixed in: 2.6.4

npmpatch availablevia ghsa

Product: asyncFixed in: 3.2.2

redhatpatch availablevia redhat_api

Product: Red Hat Migration Toolkit for Containers 1.7Fixed in: rhmtc/openshift-migration-ui-rhel8:v1.7.7-3

View patch

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Service Mesh 2.2 for RHEL 8Fixed in: openshift-service-mesh/prometheus-rhel8:2.2.7-7

View patch

redhatvendor investigatingvia redhat_api

Product: Migration Toolkit for VirtualizationFixed in: migration-toolkit-virtualization/mtv-ui-rhel8

redhatno patchvia redhat_api

Product: Red Hat Openshift Container Storage 4Fixed in: ocs4/mcg-core-rhel8

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: noobaa-core-container

redhatno patchvia redhat_api

Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/mcg-core-rhel9

redhatno patchvia redhat_api

Product: OpenShift Service Mesh 2.0Fixed in: servicemesh-prometheus

redhatno patchvia redhat_api

Product: OpenShift Service Mesh 2.0Fixed in: servicemesh-grafana

redhatno patchvia redhat_api

Product: Red Hat Quay 3Fixed in: quay/quay-rhel8

redhatno patchvia redhat_api

Product: OpenShift Service Mesh 2.0Fixed in: openshift-service-mesh/kiali-rhel8